Over the years in the compliance and security space, the practice of proactively managing digital risk has moved from a nice-to-have to a must-have for enterprise organizations. And over the last 5 years, things have shifted drastically. Let's explore how shared accountability matters in the current governance risk and compliance space.
What is Governance, Risk, and Compliance?
Governance, risk, and compliance make up the three parts of an organization's risk management and security strategies to meet industry and government standards.
Compliance, Risk Management, Security, and IT are all bones connected to form the body of an organization—but we haven’t always treated them as such.
Back to topGDPR Shook Up Traditional Governance, Risk, and Compliance
Global regulations such as the General Data Protection Regulation (GDPR) with unprecedented penalties have acted as a catalyst for organizations to identify the types of data within their network and infrastructure in order to best manage and protect it.
As it became clear that regulations like GDPR were going to keep coming, organizations had to identify who was in charge of managing the operations to find this valuable data and ensure its security and compliance. In 2018, GDPR required the role of the Data Privacy Officer (DPO) to head up all things around data protection accountability. Yes, GDPR is a mammoth regulation, but enterprise leaders needed to know how its requirements align and overlap with other regulations such as HIPAA, PCI DSS, FedRAMP, etc., and how these regulations align with current security frameworks they may be leveraging, such as NIST, ISO, or even the growing Center for Internet Security (CIS) benchmark best practices. It was apparent to those of us in this space that the scope of traditional GRC had just exploded.
The role of the DPO didn’t widely exist yet in 2018 for many enterprise companies, so it became a driver for organizations to consider redefining who-owns-what within the scope of compliance. Enterprise organizations soon realized there was a lot of crossover between various business-problem owners, especially in the areas of IT, compliance, security, and risk management, e.g., “Dry Bones.”
Back to topUnraveling the Growing Governance, Risk, and Compliance Conundrum
Traditional GRC (Governance, Risk, and Compliance) departments often rolled up to the CISO (Chief Information Security Officer) – sometimes with a layer of the Risk Officer role in between – and from there the CISO often rolled up to the CIO (Chief Information Officer). The threat landscape was evolving at a rapid pace and soon the topic of security moved from a department challenge to a board room level discussion.
Unraveling of the silos – The evolving role of the CISO The role of the CISO had to evolve from focusing primarily on reactive cybersecurity strategies to enveloping the company goals of security, compliance, and risk management. Soon analysts such as Gartner outlined the idea of IRM (Integrated Risk Management) that included digital and cyber risk management.
The role of the CISO became accountable for ensuring more than just cybersecurity, but also for fostering a secure and compliant culture throughout the business. One of the ways a CISO can accomplish this goal is by partnering internally with IT Operations, risk, and compliance leaders to reduce work done in silos that could create vulnerabilities for the business.
In 2021, there has been an additional evolution of these roles and responsibilities. The beginning of the COVID-19 pandemic forced organizations to shift to a remote-first work culture seemingly overnight. IT Operation teams are challenged with constantly changing and competing priorities from the business and have to be agile to keep the business running smoothly.
But keeping it running securely and not drifting from compliance standards was quite another battle. The larger the infrastructure or hybrid infrastructure, the more complexities presented themselves. IT Operations and Information Security teams had to truly partner to focus on hardening security and enforcing continuous compliance across the IT Infrastructure. But how?
Fortunately, we wrote more about this in Foster a Culture of Joint Accountability for Security and Compliance Across an Organization to help you in your journey.
Back to topWhat Does the Future Hold for Governance, Risk, and Compliance?
The past 18 months have been unprecedented, to say the least. Some organizations are choosing to keep their workforce remote, others are pulling people back into the office, while others are offering a hybrid model.
Prior to the pandemic, both IT and Security teams had been leveraging some form of automation to work smarter, not harder. But solving for security and compliance is not a one-person or single department’s job. Everyone needs to pull their weight, and the best way to do that is to partner cross-functionally within your organization with the common goal of hardening security and ensuring continuous compliance with both internal policies and external regulations and standards.
Savvy organizations understand that leveraging automation technology in both security and compliance efforts plays a crucial part in building the bridges that connect every bone in the organization’s body. Automation allows for transparency into how policies are encoded into infrastructure, and it is repeatable, reliable enforcement of those policies. Trusting that the desired state is being automatically enforced helps with productivity, yes, but it also allows IT and security teams to focus on novel threats and vulnerability remediation.
Needless to say, IT, Security, Risk, and Compliance owners will have to stay on their toes. Our new ebook can guide you through breaking down silos and achieving your goals.
Explore More Compliance and Security Topics:
- Watch the webinar on Fostering a Culture of Joint Accountability
- Discover the difference between security and compliance.
- Read about the IDC report on the importance of autonomous compliance.
- Get the guide: Are DevOps and Security Mutually Exclusive?
- Learn the value of continuous compliance.